Maneek21 · Oct 20, 2026 · Oct 20, 2026
diff --git a/README.md b/README.md
@@ -16,13 +16,13 @@ Email builds without a Deft source checkout or private Deft imports. Operators u
 
 ## Supported compatibility set
 
-The [published compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.18/compatibility.json) is the authoritative detached public release record. The repository [`release/compatibility.json`](release/compatibility.json) is its source template and also records that URL. The published record identifies the Host version/commit/image/schema, App and Runtime versions, each component's Kit, public assets, checksums and corresponding source. Use its verified publication state and release assets; a candidate record or open PR does not establish that downloads are available.
+The [published compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.19/compatibility.json) is the authoritative detached public release record. The repository [`release/compatibility.json`](release/compatibility.json) is its source template and also records that URL. The published record identifies the Host version/commit/image/schema, App and Runtime versions, each component's Kit, public assets, checksums and corresponding source. Use its verified publication state and release assets; a candidate record or open PR does not establish that downloads are available.
 
-This unreleased source builds App **1.9.0-preview.14** with Kit **0.1.0-alpha.39** and Runtime **0.4.0-preview.18** with Kit **0.1.0-alpha.35**. Their different Kit versions are intentional. The supported Host requires schema **120** and the exact generic contracts in the manifest. An older stable Host or a matching schema number alone is insufficient.
+Release bundle **1.9.0-preview.19** builds App **1.9.0-preview.15** with Kit **0.1.0-alpha.39** and Runtime **0.4.0-preview.18** with Kit **0.1.0-alpha.35**. Their different Kit versions are intentional. The supported Host requires schema **120** and the exact generic contracts in the manifest. An older stable Host or a matching schema number alone is insufficient.
 
-The unreleased source adds Email's own background-refresh description and requires Host **0.3.0-preview.127 or newer**. Older Hosts reject the new experience-bundle field. This change is for review only; it does not replace the published preview.18 artifacts, and App/release version allocation is deferred to release preparation. [Kit provenance and validation](docs/background-refresh-description.md).
+This release adds Email's own background-refresh description and requires Host **0.3.0-preview.127 or newer**. Older Hosts reject the new experience-bundle field. App preview.15 carries the new bundle field. Runtime preview.18 is unchanged and retains its existing sessions and durable store. [Kit provenance and validation](docs/background-refresh-description.md).
 
-Published release bundle **1.9.0-preview.18** selects Host **0.3.0-preview.125**. The Runtime now accepts background sessions that the Host delivers when an owner re-establishes background access after an App upgrade, so nobody copies session tokens into operator files. The App and both Kit packages are unchanged. Host preview.125 still uses schema120; no schema migration is needed.
+Previous release bundle **1.9.0-preview.18** selects Host **0.3.0-preview.125**. The Runtime now accepts background sessions that the Host delivers when an owner re-establishes background access after an App upgrade, so nobody copies session tokens into operator files. The App and both Kit packages are unchanged. Host preview.125 still uses schema120; no schema migration is needed.
 
 ## Build independently
 

diff --git a/app/package-lock.json b/app/package-lock.json
diff --git a/app/package.json b/app/package.json
@@ -7,7 +7,7 @@
     "@deft/app-kit": "file:deft-app-kit-0.1.0-alpha.39.tgz",
     "esbuild": "0.28.2"
   },
-  "version": "1.9.0-preview.14",
+  "version": "1.9.0-preview.15",
   "scripts": {
     "build": "node build.mjs",
     "test": "node --test release-package.test.mjs imported-history.test.mjs",

diff --git a/app/release-package.test.mjs b/app/release-package.test.mjs
@@ -22,7 +22,7 @@ test('packed public Kit keeps the displayed target on a mailbox refresh', async
 
 test('fresh package authenticates its manifest and worker artifact against public Kit39', () => {
   assert.equal(DEFT_APP_KIT_VERSION, '0.1.0-alpha.39');
-  assert.equal(metadata.version, '1.9.0-preview.14');
+  assert.equal(metadata.version, '1.9.0-preview.15');
   assert.equal(compatibility.email.tag, 'v' + rootMetadata.version);
   assert.equal(compatibility.email.app_version, metadata.version);
   assert.equal(compatibility.host.minimum_version, '0.3.0-preview.127');

diff --git a/docs/author-independence.md b/docs/author-independence.md
@@ -2,7 +2,7 @@
 
 The developer-preview claim is specific: a developer can build this connected Email App from its public repository and public Author Kit packages, sideload it into a compatible Deft Host, deploy its provider Runtime separately, and update Email without changing that Host. It does not claim that operator setup is automatic or that any older Deft release accepts these contracts.
 
-Use [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.18/compatibility.json) for exact artifacts and [verification](verification.md) for acceptance. Historical demo results remain tied to their own versions.
+Use [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.19/compatibility.json) for exact artifacts and [verification](verification.md) for acceptance. Historical demo results remain tied to their own versions.
 
 ## Ownership
 

diff --git a/docs/background-refresh-description.md b/docs/background-refresh-description.md
@@ -1,4 +1,4 @@
-# Unreleased Email background-refresh description
+# Email preview.19 background-refresh description
 
 Email now owns the explanation displayed in its background-refresh review:
 
@@ -8,4 +8,4 @@ Email now owns the explanation displayed in its background-refresh review:
 
 The App uses sealed Author Kit alpha.39, built and packed from `packages/app-kit` in the public Host preview.127 source. `scripts/verify-pins.mjs`, the npm lockfile, and `release/compatibility.json` pin its exact bytes. Alpha.38 remains retained as a historical input, and the Runtime keeps its unchanged alpha.35 package and source provenance. The Host source tag and source archive allow reconstruction of the new Kit; no local Host checkout is required to build Email from this repository.
 
-Validation includes a fresh App build, package verification of the exact description and Host minimum, App/UI tests, Runtime tests, and provenance checks. This is an unreleased source candidate for review. The published Email preview.18 artifacts remain unchanged; a later release preparation must allocate the new App/release identity and resolve a new detached compatibility record.
+Validation includes a fresh App build, package verification of the exact description and Host minimum, App/UI tests, Runtime tests, and provenance checks. Bundle preview.19 allocates App preview.15 and retains unchanged Runtime preview.18. The detached compatibility record resolves published Host127 assets and the exact release commit. Preview.18 remains available for rollback.
diff --git a/docs/compatibility.md b/docs/compatibility.md
@@ -2,13 +2,13 @@
 
 [`release/compatibility.json`](../release/compatibility.json) is the source template and entry point. Follow its `authoritative_release_manifest` URL for the single authoritative detached cross-component release record. Use that resolved record for exact Host and Email commits, versions, image digests, schema/contracts, Kit artifacts, download locations, checksums and corresponding source. The publication state in that record distinguishes a prepared candidate from a verified public release. Do not replace its pins with a branch tip, a similarly named preview or a demo image.
 
-## Unreleased source contract
+## Release preview.19 contract
 
-The source candidate requires Host preview.127 or newer. The linked preview.18 release record remains historical for this candidate; its Host125 and Kit38 pins apply to the already-published bundle. Do not use that record to install this source candidate. No Email release is part of this change.
+Bundle preview.19 requires Host preview.127 or newer and pairs App preview.15 with unchanged Runtime preview.18. The detached release record binds the new App and Kit39 to the published Host127 assets. Preview.18 remains available for rollback.
 
 | Component | Version/contract |
 |---|---|
-| Email App | `1.9.0-preview.14` |
+| Email App | `1.9.0-preview.15` |
 | App Author Kit | `0.1.0-alpha.39` |
 | Email Runtime | `0.4.0-preview.18` |
 | Runtime Author Kit | `0.1.0-alpha.35` |

diff --git a/docs/independence-upgrade.md b/docs/independence-upgrade.md
@@ -2,7 +2,7 @@
 
 The existing example is an optional private note on a draft, up to 1000 characters, kept out of outgoing MIME. It is already implemented; no new feature is needed to demonstrate independence. New drafts may use the note, while retained pre-note drafts keep their original form without an on-read migration.
 
-Current App and Runtime identities come from [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.18/compatibility.json). This source is App `1.9.0-preview.14` with Kit38 and Runtime `0.4.0-preview.18` with Kit35. Historical App7/Runtime9 upgrade/retention receipts apply only to those frozen versions. [Verification](verification.md) records which final-release evidence was reused and which checks were rerun.
+Current App and Runtime identities come from [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.19/compatibility.json). This source is App `1.9.0-preview.15` with Kit39 and Runtime `0.4.0-preview.18` with Kit35. Historical App7/Runtime9 upgrade/retention receipts apply only to those frozen versions. [Verification](verification.md) records which final-release evidence was reused and which checks were rerun.
 
 ## Demonstrate the boundary
 

diff --git a/docs/limitations.md b/docs/limitations.md
@@ -1,6 +1,6 @@
 # Developer-preview limitations
 
-This preview demonstrates a connected, independently deployed Email App using public Deft contracts. It is intended for developers and operators, with Gmail as the accepted provider path. It does not promise effortless onboarding, full Gmail/Outlook parity or production-scale operation. Exact published identities and acceptance belong to [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.18/compatibility.json) and [verification](verification.md).
+This preview demonstrates a connected, independently deployed Email App using public Deft contracts. It is intended for developers and operators, with Gmail as the accepted provider path. It does not promise effortless onboarding, full Gmail/Outlook parity or production-scale operation. Exact published identities and acceptance belong to [the compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.19/compatibility.json) and [verification](verification.md).
 
 ## Known behavior
 

diff --git a/docs/release.md b/docs/release.md
@@ -1,6 +1,6 @@
 # Developer-preview release procedure
 
-This release demonstrates an independently built connected App using public Author Kit contracts. It does not certify a production mail service or add roadmap features. [The compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.18/compatibility.json) is authoritative for the final integrated source and artifacts; [limitations](limitations.md) must accompany the prerelease.
+This release demonstrates an independently built connected App using public Author Kit contracts. It does not certify a production mail service or add roadmap features. [The compatibility manifest](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.19/compatibility.json) is authoritative for the final integrated source and artifacts; [limitations](limitations.md) must accompany the prerelease.
 
 ## Freeze and integrate
 
@@ -14,7 +14,7 @@ Use the final integrated commits, not the pre-merge demo commits, as release sou
 2. Build Email in a clean directory from public source and the pinned Kit tarballs using [README commands](../README.md#build-independently). Verify provenance and focused CI. Build the App twice and compare package bytes when establishing the release package identity.
 3. Record the App package SHA256, canonical manifest digest, experience digest and worker hash from the generated artifacts. The root version identifies the release bundle; the App build reads `app/package.json`. A Runtime-only packaging repair can advance the bundle and Runtime while preserving the exact App version and package bytes. Record each version separately in compatibility metadata. App and Runtime keep their independently versioned Kit pins.
 4. Run `npm run package:source` after source freeze. Retain `dist/source-manifest.json`, `dist/email-<version>-source.tar.gz` and `dist/runtime-artifact.tgz`. Runtime archive entries have one `runtime/` prefix for the documented operator Docker recipe. The deterministic source packager needs Python3's standard library; App and Runtime use Node.
-5. Publish versioned Kit35 and Kit38 tarballs and their corresponding source. Public tarball downloads are sufficient for this preview; npm publishing is not required.
+5. Publish versioned Kit35 and Kit39 tarballs and their corresponding source. Public tarball downloads are sufficient for this preview; npm publishing is not required.
 6. Fill the authoritative compatibility record with final version/commit/digest/schema/contracts and public URLs for every required artifact. Publish the exact manifest and detached checksum file with the prerelease. Do not place an archive's own checksum inside that archive or relabel older assets as a new build.
 
 ## Bounded final acceptance

diff --git a/docs/setup.md b/docs/setup.md
@@ -1,6 +1,6 @@
 # Developer-preview setup
 
-Use the exact Apps-enabled Host and public artifacts in [the authoritative compatibility record](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.18/compatibility.json). The supported Host requires schema **120** and the matching generic contracts, not merely an older compatible-looking release label. Check the record's publication state and download hashes before starting. [Verification](verification.md) distinguishes previous demo evidence from final public acceptance.
+Use the exact Apps-enabled Host and public artifacts in [the authoritative compatibility record](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.19/compatibility.json). The supported Host requires schema **120** and the matching generic contracts, not merely an older compatible-looking release label. Check the record's publication state and download hashes before starting. [Verification](verification.md) distinguishes previous demo evidence from final public acceptance.
 
 The external consumer path is: obtain compatible Deft → independently build Email → sideload/review it → configure the separately operated Runtime, HTTPS/OAuth and authority → use Email and source integrations → [upgrade Email against the same Host](independence-upgrade.md). This requires operator work; no Deft source checkout, private import, native Email adapter or SQL patch is part of the Email installation.
 

diff --git a/docs/verification.md b/docs/verification.md
@@ -1,6 +1,6 @@
 # Verification and acceptance
 
-Use [the authoritative compatibility record](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.18/compatibility.json) for the exact release source, artifacts, checksums and publication state. A prepared candidate is not published merely because its files build. The final public prerelease must link its acceptance results and disclose unverified behavior.
+Use [the authoritative compatibility record](https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.19/compatibility.json) for the exact release source, artifacts, checksums and publication state. A prepared candidate is not published merely because its files build. The final public prerelease must link its acceptance results and disclose unverified behavior.
 
 ## Evidence that can be reused
 

diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "deft-email-preview",
-  "version": "1.9.0-preview.18",
+  "version": "1.9.0-preview.19",
   "private": true,
   "license": "AGPL-3.0-only",
   "type": "module",

diff --git a/release/compatibility.json b/release/compatibility.json
@@ -1,8 +1,8 @@
 {
   "schema": "deft.email.preview.compatibility.v1",
   "publication_state": "source-template",
-  "authoritative_release_manifest": "https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.18/compatibility.json",
-  "resolution": "Unreleased source changes require Host preview.127; the linked preview.18 manifest describes the previous published bundle and does not certify this candidate. A future detached release asset must resolve exact tagged source commits, Host image digest and asset SHA256 values after packaging. This source template does not certify publication or contain its own archive checksum.",
+  "authoritative_release_manifest": "https://github.com/Maneek21/deft-email/releases/download/v1.9.0-preview.19/compatibility.json",
+  "resolution": "The detached preview.19 release asset resolves exact tagged source commits, Host preview.127 image digest and asset SHA256 values after packaging. This source template does not certify publication or contain its own archive checksum.",
   "host": {
     "version": "0.3.0-preview.127",
     "minimum_version": "0.3.0-preview.127",
@@ -14,9 +14,9 @@
     "contracts": { "app_protocol": 7, "connection_protocol": 2, "record_form": 3, "resource_sync_channel": 3 }
   },
   "email": {
-    "tag": "v1.9.0-preview.18",
+    "tag": "v1.9.0-preview.19",
     "repository": "https://github.com/Maneek21/deft-email",
-    "app_version": "1.9.0-preview.14",
+    "app_version": "1.9.0-preview.15",
     "runtime_version": "0.4.0-preview.18",
     "app_kit_version": "0.1.0-alpha.39",
     "runtime_kit_version": "0.1.0-alpha.35",